Skip to main content
Patient portal authentication is separate from integration OAuth. Use the API host approved for your integration and an approved test phone for verification. All paths below are relative to NIMBO_API_BASE_URL, including /api/v1.

​
Request and validate a code

Send POST /patient_portal/auth with the phone’s country calling code and number. These strings are placeholders, not a usable phone number.
Collect the code received by the patient, then send POST /patient_portal/validate with the same phone details:
The successful validation response contains token. Keep it private and use it as the bearer token on patient-portal reads. Do not substitute an integration OAuth token or assume the portal token supports OAuth refresh.

​
Select an authorized person

Call GET /patient_portal/people with Authorization: Bearer <PATIENT_PORTAL_TOKEN>. A phone can be linked to multiple patient identities. Let the patient select the appropriate returned person and use that person’s ID in subsequent requests; do not assume that any known patient ID is authorized. Consult each response schema rather than assuming these endpoints return the same envelope. Booking links depend on the organization’s subscription and visibility settings.
Reading /medical_history creates a medical-history record if no active record exists. Avoid speculative prefetching of that endpoint.
All 13 operations are grouped under Patient portal in the Browse endpoints and the patient portal specification.